CVE-2018-15833

low-risk

Published 2018-08-26

In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).

Do I need to act?

0.19% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Vanilla Forums

Affected Vendors

Vanillaforums

References (8)

Third Party Advisory https://hackerone.com/reports/326434

Vendor Advisory https://open.vanillaforums.com/discussion/36559

Third Party Advisory https://twitter.com/viperbluff/status/1033067882941304832

Third Party Advisory https://twitter.com/viperbluff/status/1033640333890834433

Third Party Advisory https://hackerone.com/reports/326434

Vendor Advisory https://open.vanillaforums.com/discussion/36559

Third Party Advisory https://twitter.com/viperbluff/status/1033067882941304832

Third Party Advisory https://twitter.com/viperbluff/status/1033640333890834433

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal